Privacy policy

Who is responsible

DAWN is operated by Stockholm IT Academi AB, organisation number 559337-9141, Fallskärmsgatan 1 lgh 1302, 128 34 Skarpnäck, Stockholm, Sweden. Contact hello@dawnhcm.com about this notice or your personal data.

We are controller for our website, direct enquiries, account administration and service security where we determine the purpose of processing. An employer or other organisation normally controls the recruitment and workforce records it manages in DAWN. We process those records on its documented instructions. Your organisation’s notice explains its purposes, legal bases and retention choices.

Information and sources

Visiting the website sends technical request information, including your IP address, requested address, browser information and timestamps, to our hosting infrastructure. The website remembers language and motion preferences locally. It does not load advertising trackers or analytics scripts.

When you contact us, we receive your contact details and message. The application can process names, email addresses, telephone numbers, password hashes, verification details, organisation memberships, roles and permissions. Depending on the features used, it also processes CVs, qualifications, applications, employment records, conversations, attachments, interview answers, recordings, transcripts, generated assessments and review decisions.

Information comes from you, your organisation, authorised colleagues, selected integrations and technical events. Identity verification can involve an identity provider and a Swedish personal identity number where that feature is used. Only provide sensitive information when it is necessary, lawful and appropriate for the selected feature.

Purposes and legal bases

We use account information to provide the service you request and perform the user agreement. We use direct enquiry details to answer your request and take steps towards an agreement where you ask us to do so. Business correspondence, technical diagnostics and misuse prevention are based on our legitimate interests in operating, securing and supporting DAWN, subject to your rights.

Legal obligations may require us to preserve particular records or respond to authorities. Where processing requires consent, it must be specific and can be withdrawn. Optional marketing requires its own applicable legal basis; contacting us does not automatically subscribe you to marketing.

You may withhold information, but we cannot create an account or answer a request without the details necessary for it. Organisations must establish their own legal basis for workforce processing and an additional lawful condition where special category data is involved.

AI, voice and human review

Text, selected context, documents or audio can be sent to configured AI and speech services to perform the requested task. Output may contain errors or bias. Employment decisions require meaningful review by an authorised person; generated output is not an independent decision by DAWN.

Recording, transcription and telephone features depend on configuration and require appropriate notice and a lawful basis. Organisations must provide any consent process or alternative required for their use. Submitting information to DAWN does not authorise unrelated model training. A separate training use requires a defined purpose, lawful basis and appropriate contractual arrangements. We do not promise that every provider has zero retention or that every request stays within Europe.

Recipients and international processing

Recipients can include authorised organisation users and providers of hosting, databases, file storage, email, identity, AI, speech and telephone services. Our provider page distinguishes documented infrastructure from integrations that depend on configuration. We may also disclose information when law requires it or to protect legal rights. We do not sell personal data or use it for third party behavioural advertising.

Processing and authorised support access can involve countries outside the EEA. A European server region does not exclude such transfers. Where required, transfers must have an applicable adequacy decision or another lawful safeguard, such as Standard Contractual Clauses with necessary supplementary measures. Contact us for the recipient, location and safeguard relevant to your service. This notice does not certify that an optional provider has been approved for your organisation.

Retention and deletion

Retention follows the purpose and responsible controller. Account details are needed while the account is active and subsequently only for closure, security, required records or legal claims. Workforce records follow the organisation’s instructions and applicable obligations. Support correspondence is kept while the matter and any related service or dispute remain relevant. Technical records are limited by their diagnostic, security and evidential purpose.

An unanswered enquiry is not permission to retain information indefinitely. We may ask whether you want continued contact; silence is not consent. Any continued retention still needs a valid purpose and legal basis.

Deletion is not the same as signing out or removing a workspace membership. Copies, storage versions and backups require separate handling. There is no universal automatic deletion deadline across all DAWN data. Contact us for a record-specific request; we identify the responsible controller, applicable retention and any lawful restriction before confirming the outcome.

Your rights and contact

Subject to applicable law, you can request access, correction, erasure, restriction and data portability, object to processing based on legitimate interests, and withdraw consent. Where relevant, you can request human intervention and contest a solely automated significant decision.

Contact hello@dawnhcm.com or the organisation responsible for your workforce records. We may need proportionate identity checks. Requests are normally answered within one month; where law permits an extension, you will be told why within that first month. You can complain to IMY in Sweden or another competent supervisory authority. This notice is updated when the processing described changes.